Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,818 results · page 51 of 57
May 17, 2022The affected On-Premise cnMaestro is vulnerable to a pre-auth data exfiltration through improper neutralization of special elements used in an SQL command.CVE-2022-1361 · Other software · Cambium Networks · reported by ics-cert@hq.dhs.govHigh 7.4
The affected On-Premise cnMaestro is vulnerable to a pre-auth data exfiltration through improper neutralization of special elements used in an SQL command. This could allow an attacker to exfiltrate data about other user’s accounts and devices.
- Product
- cnMaestro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022The affected On-Premise is vulnerable to data exfiltration through improper neutralization of special elements used in an SQL command.CVE-2022-1358 · Other software · Cambium Networks · reported by ics-cert@hq.dhs.govMedium 5.9
The affected On-Premise is vulnerable to data exfiltration through improper neutralization of special elements used in an SQL command. This could allow an attacker to exfiltrate and dump all data held in the cnMaestro database.
- Product
- cnMaestro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 anCVE-2022-26116 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.2
Multiple improper neutralization of special elements used in SQL commands ('SQL Injection') vulnerability [CWE-89] in FortiNAC version 8.3.7 and below, 8.5.2 and below, 8.5.4, 8.6.0, 8.6.5 and below, 8.7.6 and below, 8.8.11 and below, 9.1.5 and below, 9.2.2 and below may allow an authenticated attacker to execute unauthorized code or commands via specifically crafted strings parameters.
- Product
- Fortinet FortiNAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
May 4, 2022Experian Hunter 1.16 allows remote authenticated users to modify assumed-immutable elements via the (1) rule name parameter to the Rules page or the (2) subruleCVE-2022-29950 · Other software · Experian · reported by MITREMedium 4.3
Experian Hunter 1.16 allows remote authenticated users to modify assumed-immutable elements via the (1) rule name parameter to the Rules page or the (2) subrule name or (3) categories name parameter to the Subrules page. NOTE: the vendor disputes this because version 1.16 has never existed
- Product
- Hunter
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comexperian.in
May 1, 2022Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1.CVE-2022-1544 · Other software · luyadev · reported by security@huntr.devHigh 7.8
Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.
- Product
- luyadev/yii-helpers
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 25, 2022Master Elements: Does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statementCVE-2022-0693 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL Injection
- Product
- Master Elements
- Affected
- up to 8.0
- What to do
- Affects up to 8.0. Update Master Elements to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 18, 2022Loco Translate: Does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panelCVE-2022-0765 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them in the editor in the plugin admin panel, allowing any user with access to the plugin (Translator and Administrator by default) to add arbitrary javascript payloads to the source strings leading to a stored cross-site scripting (XSS) vulnerability.
- Product
- Loco Translate
- Fixed in
- 2.6.1
- What to do
- Update Loco Translate to 2.6.1 or newer.
Apr 14, 2022Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to informatioCVE-2021-43257 · Other software · Mantisbt · reported by MITREHigh 7.8
Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.php generated CSV file in Excel.
- Product
- Mantisbt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.commantisbt.org
Apr 13, 2022A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution CVE-2021-22795 · Other software · Schneider Electric · reported by cybersecurity@se.comCritical 9.1
A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution when performed over the network. Affected Product: StruxureWare Data Center Expert (V7.8.1 and prior)
- Product
- StruxureWare Data Center Expert
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2022An improper neutralization of special elements used in an OS command vulnerability in the command line interpreter of FortiAuthenticator before 6.3.1 may allow CVE-2021-26116 · Network & remote access · Fortinet · reported by psirt@fortinet.comMedium 6.7
An improper neutralization of special elements used in an OS command vulnerability in the command line interpreter of FortiAuthenticator before 6.3.1 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.
- Product
- Fortinet FortiAuthenticator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Apr 6, 2022Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiWAN before 4.5.9 may allow an unauthenticated attacker to exCVE-2021-26114 · Network & remote access · Fortinet · reported by psirt@fortinet.comCritical 9.8
Multiple improper neutralization of special elements used in an SQL command vulnerabilities in FortiWAN before 4.5.9 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
- Product
- Fortinet FortiWAN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Apr 6, 2022Multiple improper neutralization of special elements used in an OS command vulnerabilities (CWE-78) in the Web GUI of FortiWAN before 4.5.9 may allow an authentCVE-2021-24009 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.2
Multiple improper neutralization of special elements used in an OS command vulnerabilities (CWE-78) in the Web GUI of FortiWAN before 4.5.9 may allow an authenticated attacker to execute arbitrary commands on the underlying system's shell via specifically crafted HTTP requests.
- Product
- Fortinet FortiWAN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Mar 30, 2022Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in ping tool of Profelis IT Consultancy SambaBox allows AUTHENCVE-2022-25619 · Other software · Profelis IT Consultancy · reported by cve@profelis.com.trLow 3.8
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in ping tool of Profelis IT Consultancy SambaBox allows AUTHENTICATED user to cause run arbitrary code. This issue affects: Profelis IT Consultancy SambaBox 4.0 version 4.0 and prior versions on x86.
- Product
- SambaBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsambabox.iosambabox.io
Mar 25, 2022Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager CVE-2022-22688 · Network & remote access · Synology · reported by security@synology.comHigh 8.8
Improper neutralization of special elements used in a command ('Command Injection') vulnerability in File service functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-2 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
- Product
- DiskStation Manager (DSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Mar 16, 2022Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products and older fiCVE-2022-22273 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comCritical 9.8
Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products, specifically the SRA appliances running all 8.x, 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions
- Product
- SonicWall SRA/SMA100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.global.sonicwall.compsirt.global.sonicwall.com
Mar 16, 2022Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, poteCVE-2021-42527 · Other software · Adobe · reported by AdobeHigh 7.8
Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
- Product
- Premiere Elements
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 16, 2022Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, poteCVE-2021-42526 · Other software · Adobe · reported by AdobeHigh 7.8
Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
- Product
- Premiere Elements
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 16, 2022Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file.CVE-2021-40789 · Other software · Adobe · reported by AdobeMedium 5.5
Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Premiere Elements
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 16, 2022Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file.CVE-2021-40788 · Other software · Adobe · reported by AdobeMedium 5.5
Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Premiere Elements
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 16, 2022Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, poteCVE-2021-40787 · Other software · Adobe · reported by AdobeHigh 7.8
Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
- Product
- Premiere Elements
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 16, 2022Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, poteCVE-2021-40786 · Other software · Adobe · reported by AdobeHigh 7.8
Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required to exploit this vulnerability.
- Product
- Premiere Elements
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 16, 2022Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file.CVE-2021-40785 · Other software · Adobe · reported by AdobeMedium 5.5
Adobe Premiere Elements 20210809.daily.2242976 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- Product
- Premiere Elements
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Mar 10, 2022An arbitrary code execution vulnerability was found in the F-Secure Support Tool.CVE-2021-44750 · Other software · F-Secure · reported by cve-notifications-us@f-secure.comMedium 6.4
An arbitrary code execution vulnerability was found in the F-Secure Support Tool. A standard user can craft a special configuration file, which when run by administrator can execute any commands.
- Product
- F-Secure Elements Agent, F-Secure MDR, F-Secure Client Security, F-Secure Server Security, F-Secure Email and Server Security, F-Secure Freedome VPN, F-Secure S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordf-secure.comf-secure.com
Mar 9, 2022Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.CVE-2022-0896 · Other software · microweber · reported by security@huntr.devHigh 8.8
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2022An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiAP-C console 5.4.0 through 5.4.3, 5.2.0 through 5.2.1 may alCVE-2022-22301 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.8
An improper neutralization of special elements used in an OS Command vulnerability [CWE-78] in FortiAP-C console 5.4.0 through 5.4.3, 5.2.0 through 5.2.1 may allow an authenticated attacker to execute unauthorized commands by running CLI commands with specifically crafted arguments.
- Product
- Fortinet FortiAP-C
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Mar 1, 2022A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, veCVE-2021-43077 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.8
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the AP monitor handlers.
- Product
- Fortinet FortiWLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Mar 1, 2022A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and belCVE-2021-43075 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.8
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the alarm dashboard and controller config handlers.
- Product
- Fortinet FortiWLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Feb 24, 2022Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.CVE-2022-23810 · Computers, phones & browsers · appleple inc. · reported by vultures@jpcert.or.jpMedium 6.5
Template injection (Improper Neutralization of Special Elements Used in a Template Engine) vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1 allows a remote authenticated attacker to obtain an arbitrary file on the server via unspecified vectors.
- Product
- a-blog cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddeveloper.a-blogcms.jpjvn.jp
Feb 7, 2022All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs: Was vulnerable to reflected XSS on the my-sticky-elements-leads admin pageCVE-2022-0148 · WordPress plugins & themes · reported by WPScanMedium 5.4
The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page.
- Product
- All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs
- Fixed in
- 2.0.4
- What to do
- Update All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs to 2.0.4 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Feb 6, 2022Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in Synology DiskStationCVE-2021-43929 · Network & remote access · Synology · reported by security@synology.comMedium 6.5
Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in work flow management in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- DiskStation Manager (DSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Feb 6, 2022Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving component in Synology MaiCVE-2021-43928 · Network & remote access · Synology · reported by security@synology.comCritical 9.9
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in mail sending and receiving component in Synology Mail Station before 20211105-10315 allows remote authenticated users to execute arbitrary commands via unspecified vectors.
- Product
- Mail Station
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Feb 6, 2022Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in Synology DiskStation CVE-2021-43927 · Network & remote access · Synology · reported by security@synology.comMedium 4.7
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Security Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.
- Product
- DiskStation Manager (DSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Feb 6, 2022Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation ManagCVE-2021-43926 · Network & remote access · Synology · reported by security@synology.comMedium 4.7
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.
- Product
- DiskStation Manager (DSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Feb 6, 2022Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation ManagCVE-2021-43925 · Network & remote access · Synology · reported by security@synology.comMedium 4.7
Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log Management functionality in Synology DiskStation Manager (DSM) before 7.0.1-42218-2 allows remote attackers to inject SQL commands via unspecified vectors.
- Product
- DiskStation Manager (DSM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsynology.comsynology.com
Feb 2, 2022A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below alloCVE-2021-41018 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.8
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and below, 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.
- Product
- Fortiweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Feb 2, 2022A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and beCVE-2021-43073 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.8
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.
- Product
- Fortiweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Feb 2, 2022A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiExtender version 7.0.1 and below, 4.2.3 and below, 4.1.7 CVE-2021-41016 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 7.8
A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiExtender version 7.0.1 and below, 4.2.3 and below, 4.1.7 and below allows an authenticated attacker to execute privileged shell commands via CLI commands including special characters
- Product
- Fortiextender Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Feb 1, 2022WOOF: Does not sanitise and escape the woof_redraw_elements before outputing back in an admin pageCVE-2021-25085 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WOOF WordPress plugin before 1.2.6.3 does not sanitise and escape the woof_redraw_elements before outputing back in an admin page, leading to a Reflected Cross-Site Scripting
- Product
- WOOF
- Fixed in
- 1.2.6.3
- What to do
- Update WOOF to 1.2.6.3 or newer.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwpscan.com
Jan 21, 2022Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1.CVE-2022-0323 · Other software · bobthecow · reported by security@huntr.devHigh 8.8
Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1.
- Product
- bobthecow/mustache.php
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 17, 2022pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL CommandCVE-2022-0258 · Other software · pimcore · reported by security@huntr.devHigh 8.8
pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 14, 2022dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL CommandCVE-2022-0224 · Other software · dolibarr · reported by security@huntr.devCritical 9.8
dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
- Product
- dolibarr/dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 20, 2021Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements (e.g., access control details) and modify a few aspects of the appliCVE-2021-44676 · Email & office · Zohocorp · reported by MITRECritical 9.8
Zoho ManageEngine Access Manager Plus before 4203 allows anyone to view a few data elements (e.g., access control details) and modify a few aspects of the application state.
- Product
- Manageengine Access Manager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpitstop.manageengine.commanageengine.com
Dec 9, 2021wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL CommandCVE-2021-3817 · Other software · wbce · reported by security@huntr.devCritical 9.8
wbce_cms is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
- Product
- wbce/wbce_cms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Dec 8, 2021A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose CVE-2021-42760 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.8
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to disclose sensitive information from DB tables via crafted requests.
- Product
- Fortinet FortiWLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Dec 8, 2021Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and belCVE-2021-36180 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.1
Multiple improper neutralization of special elements used in a command vulnerabilities [CWE-77] in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.5 and below may allow an authenticated attacker to execute unauthorized code or commands via crafted parameters of HTTP requests.
- Product
- Fortinet FortiWeb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Dec 8, 2021Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inCVE-2021-20039 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comHigh 8.8
Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user. This vulnerability affected SMA 200, 210, 400, 410 and 500v appliances.
- Product
- SonicWall SMA100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compsirt.global.sonicwall.com
Nov 16, 2021Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MedData HBYS allows SQL Injection.This issue affects HBYS:CVE-2021-43362 · Other software · MedData · reported by iletisim@usom.gov.trCritical 9.9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MedData HBYS allows SQL Injection.This issue affects HBYS: from unspecified before 1.1.
- Product
- HBYS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Nov 16, 2021Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MedData HBYS allows SQL Injection.This issue affects HBYS:CVE-2021-43361 · Other software · MedData · reported by iletisim@usom.gov.trCritical 9.9
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MedData HBYS allows SQL Injection.This issue affects HBYS: from unspecified before 1.1.
- Product
- HBYS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 12, 2021ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS CommandCVE-2021-3934 · Other software · ohmyzsh · reported by security@huntr.devHigh 7.5
ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS Command
- Product
- ohmyzsh/ohmyzsh
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2021A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to exeCVE-2021-36185 · Network & remote access · Fortinet · reported by psirt@fortinet.comHigh 8.8
A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.
- Product
- Fortinet FortiWLM
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfortiguard.comfortiguard.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.